Custom Controls (OPA / Rego)

Customers can author their own controls in Rego, the policy language of Open Policy Agent (OPA). Custom controls are stored in the Platform, versioned, and sent in full with each evaluation request. They are evaluated in a sandboxed OPA runtime — never as native code.

Example (illustrative)

# Rego — deny S3 buckets without default encryption
package nimbusguard.custom.s3_encryption

default allow = false

allow {
    input.resource.resource_type == "aws_s3_bucket"
    input.resource.configuration.server_side_encryption == true
}

The control returns an outcome (status, message, evidence) that the Engine turns into a structured EvaluationResult.

:::warning Placeholder ⚠️ Replace the illustrative snippet with the real Rego contract: available input shape, expected output fields, and how the outcome maps to PASS/FAIL. :::